Dr. Nic Williams

**Name of the Vulnerable Software and Affected Versions** Cloud Foundry BOSH versions v264 prior to v264.14.0 Cloud Foundry BOSH versions v265 prior to v265.7.0 Cloud Foundry BOSH versions v266 prior to v266.8.0 Cloud Foundry BOSH versions v267 prior to v267.2.0 **Description** The issue allows refresh tokens to be used as access tokens when using UAA for authentication. A remote attacker with an admin refresh token given by UAA can access BOSH resources without obtaining an access token, even if their user no longer has access to those resources. **Recommendations** For Cloud Foundry BOSH version v264, update to version v264.14.0 or later. For Cloud Foundry BOSH version v265, update to version v265.7.0 or later. For Cloud Foundry BOSH version v266, update to version v266.8.0 or later. For Cloud Foundry BOSH version v267, update to version v267.2.0 or later.

**Name of the Vulnerable Software and Affected Versions** Cloud Foundry UAA versions 4.19 prior to 4.19.2 Cloud Foundry UAA versions 4.12 prior to 4.12.4 Cloud Foundry UAA versions 4.10 prior to 4.10.2 Cloud Foundry UAA versions 4.7 prior to 4.7.6 Cloud Foundry UAA versions 4.5 prior to 4.5.7 **Description** The issue incorrectly authorizes requests to admin endpoints by accepting a valid refresh token in lieu of an access token. This affects the administrative endpoints of the UAA, such as /Users and /Groups. Refresh tokens have a longer expiration time than access tokens, allowing the possessor of a refresh token to authenticate longer than expected. However, if the user has been deleted or had groups removed, or the client was deleted, the refresh token will no longer be valid. **Recommendations** For Cloud Foundry UAA version 4.19 prior to 4.19.2, update to version 4.19.2 or later. For Cloud Foundry UAA version 4.12 prior to 4.12.4, update to version 4.12.4 or later. For Cloud Foundry UAA version 4.10 prior to 4.10.2, update to version 4.10.2 or later. For Cloud Foundry UAA version 4.7 prior to 4.7.6, update to version 4.7.6 or later. For Cloud Foundry UAA version 4.5 prior to 4.5.7, update to version 4.5.7 or later.